Switch from js-sha3 to audited noble-hashes

[paulmillr]

Closes gh-310

https://github.com/paulmillr/noble-hashes#security

[phated]

Thanks!

[phated]

I rebuilt the CLI and it seems that we are blocked here by the use of node: imports until we upgrade the minimum version of nodejs we support.

I'll try harder to push that forward!

[paulmillr]

But you don't even support v12 fully?

snarkjs/.github/workflows/tests.yml

Line 14 in 918b4ad

node-version: ["14", "16", "18"]

snarkjs/.github/workflows/tests.yml

Line 42 in 918b4ad

# Pinning to 18.15 and dropped 20 due to https://github.com/NomicFoundation/hardhat/issues/3877

In my opinion, supporting anything less than v18 is dangerous, because there are no security updates for these, and this is security-sensitive project. It's common now to use something else than node, such as bun / deno, so it's best to support bun instead of ancient node.

[phated]

The minimum supported version isn't up to me 😂 like I said, I'll continue to press.